Skip to content
Australian real-estate privacy

The privacy rules changed. Your agency's paperwork didn't.

New privacy obligations apply from 1 July 2026. Check where your agency stands in two minutes.

Sample resultat risk38/100
Collection notices ! Privacy policy (1 July update required) Staff access ! Data-breach plan Open-home sign-ins ! Data retention ! ID handling ! Tenancy-DB checks
3 of 8 areas covered · sample, not your score
Check my agency's privacy score

No email needed · your answers stay in your browser

The privacy regulator has real estate in focus · penalties can apply
Fourteen solicitor-reviewed documents
13Grounded in the
Privacy Act & 13 APPs
Australian-made for
Australian real estate

How Privaproof works

1

Take the 2-minute audit

Answer 8 quick questions and see exactly where your agency stands.

2

Get your kit

Real-estate-specific privacy documents, ready to use. All fourteen reviewed by an Australian solicitor.

3

We keep it current

Updated as the law changes, so you never quietly fall out of date.

Why not just use a free template?

A good free template is a genuine free starting point for the general Privacy Principles. Here's what happens after that.

Free /
generic template
The
Privaproof Kit
Written for Australian real estateopen homes, tenancy, tenant ID, AML data
Covers the 1 Jul 2026 AML→Privacy triggercustomer-ID data below $3m
All fourteen documents reviewed by an Australian solicitor
Kept current when the law changesnew versions pushed to youstatic
Each document mapped to its APP / NDB obligation
Plain-English, step-by-step to tailor it
Price$0A$539/yr incl GST
founding

Get the Kit · A$539/year →

Why now

The privacy rules changed on 1 July 2026.

A short timeline of what shifted, who it reaches, and why real-estate agencies are now in scope, even below the $3 million small-business threshold.

1 JUL 2026From 1 July 2026, the customer-ID and AML data you collect can fall under the Privacy Act, even below the $3m small-business threshold.
SINCE JUN 2025Individuals can sue directly over serious privacy breaches.
NOWThe OAIC has named real estate a target of its privacy sweep.
ALWAYS ONNotifiable Data Breaches scheme: eligible breaches must be reported.
THE STANDARD13 Australian Privacy Principles apply.
What it actually costs. In October 2025 the Federal Court ordered the first civil penalty ever handed down under the Privacy Act: A$5.8 million against Australian Clinical Labs. Two parts of that order matter more to an agency than the headline figure. A$800,000 was for failing to properly assess a suspected data breach. A further A$800,000 was for failing to give the Commissioner the statement it was required to give. Neither was for the hack itself. Both were for what the business did in the weeks afterwards. There is now a second route as well. Since 2025, a tenant, buyer or vendor can sue you directly for a serious invasion of their privacy, without having to prove they lost a cent. Carelessness alone is not enough: the invasion has to be intentional or reckless. Most agencies will never see a penalty. What decides how bad it gets is whether the policy, the collection notice and the breach plan already exist on the day it happens. More rules land 10 Dec 2026: see the compliance calendar →

What your readiness audit checks

Eight plain-English questions, each mapped to the Australian Privacy Principle behind it.

APP 1 · 5

How you handle personal information

Collection, consent, and the notices you give tenants and landlords when you take their data.

NDB · APP 11

Data-breach readiness

Whether you can detect, contain and notify a breach the way the Notifiable Data Breaches scheme expects.

APP 1

Your privacy policy & consent

Whether your policy is current, findable, and actually reflects how your agency operates today.

APP 12 · 13

Access & correction requests

How you respond when someone asks to see, fix, or delete the personal information you hold.

How much sensitive data you really hold

One listing spreads identity, financial and AML data across your systems and the people you work with. Under the APPs, every copy is your responsibility, even below the $3m threshold, because AML/CTF customer-ID data can fall in scope.

Your agencynames · IDs · finances
CRM / database
Email inbox
Trust account
Contractors
Tenancy database
Cloud storage
ID verification

illustrative sample · not official statistics

Every arrow is a place personal data lives, and a place it can leak: 12+ data types across 8+ touchpoints.

A personalised Readiness Score, and the gaps to fix first.

Not a pass/fail. You get a score across the APPs that apply to your agency, every gap we find, and a prioritised fix-first list you can act on this week, or hand to your principal.

See your score first →
Proof, not promises.
Every check maps to a specific Australian Privacy Principle, so you can point to the exact rule behind your score.
APP 1APP 5APP 11NDB scheme

Why you can trust this audit

No faces, no vague badges. For a privacy product, credibility has to be shown, so here's exactly how it's built.

Grounded in the source

Every question maps to a specific Australian Privacy Principle, not vague "best practice".

APP 1APP 5APP 11

Australian-made, kept up to date

We watch Australian privacy law and OAIC guidance, so the audit reflects the rules as they stand today, not last year's version.

Privacy by design

Your audit answers are scored in your browser and never sent to us. Payments run through Stripe's hosted checkout, so we never see your card details. HTTPS everywhere, cookieless analytics.

Available now

The Privacy Act Compliance Kit is here

Plain-English privacy templates written for Australian real-estate agencies, kept current as the law changes. All fourteen documents are ready today, reviewed by an Australian solicitor.

Kept current · Kit v1.0 · updated
Get the Kit · A$539/year →

Founding price A$539, incl GST, rising to A$649 on 1 Oct 2026 · one agency office · cancel anytime · see what's inside · how that compares with lawyers, consultants and DIY →

Not ready to buy? Get compliance updates and the founding price as it moves:

Privacy-compliance updates for agencies + early access. No spam, unsubscribe anytime. We never sell your data. See our Privacy Policy.

Questions agencies ask

Does the Privacy Act apply to real-estate agents?

It depends on factors like turnover and what your agency does. Businesses under A$3m turnover have generally been exempt, but from 1 July 2026, agencies handling property sales come into the AML/CTF regime, and the customer-ID data they collect for it can fall under the Privacy Act regardless of turnover. This audit shows where you stand against the Australian Privacy Principles. APP 1 See exactly who is covered, and when the $3m exemption falls away →

What can it cost to get privacy wrong?

It depends on the conduct. At the serious end, the Privacy Act allows civil penalties of up to A$50 million, though the largest penalties are reserved by the courts for major organisations and serious breaches. For a smaller agency, the realistic exposures are an OAIC complaint or compliance notice, mandatory data-breach notification, an order to compensate affected people, and (often the biggest cost) lost client trust. Since June 2025, individuals can also sue directly for a serious invasion of privacy.

What's on a Privacy Act checklist for a property manager?

At minimum: a current privacy policy, clear collection notices, a documented data-breach response plan, and a process for access and correction requests. The 2-minute audit checks each and flags your gaps. Run the audit →

When can I get the Compliance Kit?

It's available now. All fourteen documents (including the privacy policy, collection notice and data-breach response plan) are ready today, reviewed by an Australian solicitor. Founding access is A$539/year incl GST, for one agency office, cancel anytime. Run the free self-audit to see where you stand, then get the Kit. what a real-estate privacy compliance Kit actually includes →

Is Privaproof a substitute for a lawyer?

No. Privaproof provides compliance tools and general guidance, not legal advice. Your obligations depend on your circumstances; for advice specific to your agency, consult a qualified professional.

Where is my data stored?

Your audit answers are scored in your browser and never sent to us. The little we keep (your email and score) is held on secure, globally-certified infrastructure; see our Privacy Policy for details. Payments run through Stripe's hosted checkout, so we never see your card details.

Know exactly where your agency stands, in 2 minutes.

Free. No email needed. Your answers stay private.

Start my free 2-minute audit →